Developer Guide - MedMij integration aspects

Required infrastructurele interacties / systeemroles

Required infrastructurele interacties / systeemroles - MP6.12 QURX

In-scope

Out-of-scope

Building blocks for MP6.12 QURX

This overview depicts which the building blocks which are in scope for MP6.12 data sources.

Building blocks for LatestStop query

This overview depicts which the building blocks which building blocks can be queried via a LatestStop-query.

LSP+ Implementation of availability condition (Beschikbaarheidstoets)

LSP+ Error handling

Error Handling Sequence for MedMij, Implementation Guide, and LSP+.

See specifications:

Resource interface | MedMij Afsprakenstelsels

MedMij FHIR R4 Implementation Guide 1.0.7 - informatiestandaarden

Beschikbaarheids- en ontvankelijkheidsvoorwaarde (availability condition)

The optional Early Availability Check defined by MedMij is not supported.

When a request reaches the MedMij Resource Interface, the Resource Server first validates the authentication and authorization context.

If the request does not contain an access token, the Resource Server returns HTTP 401 Unauthorized (or HTTP 400 Bad Request, both accepted within MedMij). In accordance with RFC 6750, no additional error details should be disclosed. Within a MedMij context, an OperationOutcome should not be returned because authorization failures must not reveal additional information.

If the request contains an expired or invalid access token, the Resource Server returns HTTP 401 Unauthorized together with a WWW-Authenticate: Bearer header containing error="invalid_token".

If the access token is valid but does not contain the required scope, the Resource Server returns HTTP 403 Forbidden with a WWW-Authenticate: Bearer header containing error="insufficient_scope". A FHIR OperationOutcome may be returned with issue code security.

If the request is malformed, for example because required parameters are missing, unsupported parameters are supplied, multiple token transport methods are used, or the request is otherwise syntactically incorrect, the Resource Server returns HTTP 400 Bad Request with error="invalid_request". A FHIR OperationOutcome may be included to describe the validation error.

After successful authentication and request validation, LSP+ performs an additional capability check. This validation is based on Profile Capability rather than Resource Capability.

If the requested resource type is not supported, LSP+ returns HTTP 404 Not Found together with an OperationOutcome containing issue code not-supported.

Next, the Resource Server evaluates the availability condition. If the requested information is temporarily unavailable or the availability requirements are not met, the server returns HTTP 403 Forbidden with error="access_denied". A FHIR OperationOutcome with issue code security may be returned.

If the Resource Server cannot process the request for any other reason that does not fall within the previously defined exception categories, it returns an appropriate HTTP status code and, where applicable, a corresponding FHIR OperationOutcome.

Two situations are explicitly not considered errors:

• No match for the supplied search parameters. This is treated as a successful search that simply returns no results.

• Unknown search parameters. These are handled according to the MedMij FHIR R4 search guidance and are not considered an error condition.

This sequence results in the following flow:

1. Authentication check (token present).

2. Token validity check.

3. Scope authorization check.

4. Request syntax and parameter validation.

5. LSP+ capability validation (profile-based).

6. Resource support validation.

7. Availability condition validation.

8. Request processing and business logic execution.

9. Successful response, empty result set, or appropriate error response.

Instructions for XIS-vendors on implementing errors for HL7v3 for availability condition

The following HL7v3 error situations are expected from the XIS:

• PATLFT: the patient does not meet the minimum age requirement.

• KEY204: no patient record exists because no treatment relationship has ever existed.

• KEY204: the patient record is actively shielded by the XIS.

• NF: the patient is known but no matching data is available for the requested query.

In the cases PATLFT and KEY204, a HTTP 403 Forbidden response with error value access_denied is returned by LSP+.

In the case NF, a HTTP 200 response with an empty result set is returned by LSP+.

Expected responses for MP6.12 QURX